VBScript SVCHOST容器檢測

Question

我m建立一個vb腳本，將連接到每臺計算機，目標是檢測在SVCHOST過程中運行的exe。

我該如何檢測，如果這個可執行文件存在於SVCHOST之內，並且如果是這樣終止了包含在這個可執行文件中的SVCHOST進程？

謝謝

Answer 1

您可以使用此代碼開頭：

Option Explicit 
If Not WScript.Arguments.Named.Exists("elevate") Then 
    CreateObject("Shell.Application").ShellExecute WScript.FullName _ 
    , WScript.ScriptFullName & " /elevate", "", "runas", 1 
    WScript.Quit 
End If 

Dim objWMI,colObjects,MyProcess,Process,TheProcess,DetectionProgram,MyPID 
TheProcess = "svchost.exe" 
DetectionProgram = "DcomLaunch" 
Set objWMI = GetObject("winmgmts:\\.\root\cimv2") 
Set colObjects = objWMI.ExecQuery("Select * From Win32_Process where Caption='"& TheProcess &"'") 

For Each Process in colObjects 
    MyProcess = MyProcess & Process.CommandLine & vbcrlf & "PID = " & Process.ProcessID & vbcrlf 
Next 

Wscript.Echo MyProcess 

For Each Process in colObjects 
    If InStr(1,Ucase(Process.CommandLine),UCase(DetectionProgram)) >= 1 Then 
     MyPID = Process.ProcessID 
     wscript.echo "PID = " & MyPID 
     Call Kill(MyPID) 
    End If 
Next 

'**************************************************** 
Sub Kill(PID) 
    Dim Ws,Command,Execution 
    Set Ws = CreateObject("Wscript.Shell") 
    Command = "cmd /c Taskkill /F /PID "& PID &"" 
    Execution = Ws.Run(Command,0,True) 
    Set Ws = Nothing 
End Sub 
'****************************************************